Method for generating an event log

ABSTRACT

A computer-implemented method is provided for generating an event log from raw data stored in a source system, wherein a processor is provided with a process sensor and the process sensor derives process data from the raw data, wherein the process data comprises at least one process element which comprises at least one process step. The process sensor further generates unique identifies of process elements, identifiers of process steps which are assigned to the process elements, and an order of the process steps, and stores the generated data as an event log according to a predetermined data structure.

FIELD OF THE INVENTION

The invention relates to a method for generating, in a computer system,an event log for raw data stored in a source system. The generated eventlog may be provided to a process mining system.

PRIOR ART AND BACKGROUND OF THE INVENTION

To achieve business goals, most companies and institution havepredefined business processes which have to be followed by theemployees. These processes are designed in a way to be carried out whichreaches the defined goals in an efficient way, thus adherence to theseprocesses is vital to the companies' efficiency. Unfortunately,monitoring and analyzing processes and checking for irregularities canbe time consuming and complex. To overcome this, process mining systemshelp to analyze the as-is processes.

Most tasks which are reflecting steps on the way of the process areconducted in an IT driven environment and leave traces in an IT system.Picking up these traces and reconstructing the as-is process from thisdata is the goal of process mining.

From a business process perspective a process involves the followingprocess components:

-   -   A processed element which is passing through the process.        Examples are an invoice which has to be cleared or a patient who        has to be treated in a hospital.    -   Process steps which are conducted with the process element.        Examples would be “Invoice is received” or “Registration of the        patient in the emergency room.”    -   An order of process steps which are conducted with the process        element. Examples would be that in a patient treatment process        the patient is first treated before the bill is sent to the        insurance company.

In order to reconstruct the as-is processes by process mining systems atleast one event log has to be provided to the process mining systems.Unfortunately almost no IT-system is prepared in a way that such anevent log can be retrieved immediately from the raw data comprising thetraces of executed processes. With such an event log the technicalrequirements are fulfilled to apply process mining techniques.

To address business process questions, the technical representation asan event log combined with process mining techniques at its own ismostly not sufficient for an end user in the role of a business processprofessional. Such a user requires a non-technical approach a processmining system with prepared analyses based on both event log andadjacent tables/files which contain process information.

OBJECT OF THE INVENTION

It is an object of the invention to provide solutions to sense processsteps and build up event logs based on raw data stored in a sourcesystem, i.e., to transform the source data into an event log format forfurther process mining analysis.

Solution According to the Invention

This object is solved according to the invention by a method as well asa system according to the independent claims. Preferred embodiments andfurther developments of the invention are specified in the respectivedependent claims.

In one aspect of the invention, a method for generating, in a computersystem having a processor and a storage means operatively coupled to theprocessor, an event log from raw data stored in a source system, themethod comprising

-   (a) providing at least one process sensor to the processor,-   (b) executing, by the processor, the at least one process sensor    provided to the processor, wherein the at least one process sensor    is adapted    -   to derive process data from the raw data, wherein the process        data comprises at least one process element and the at least one        process element comprises at least one process step, and    -   to generate from the derived process data        -   unique identifiers of process elements,        -   identifiers of process steps which are assigned to the            process elements, and        -   an order of the process steps, and-   (c) storing, by the processor, the generated data as event log with    the storage means according to a predetermined data structure, the    predetermined data structure comprising at least    -   a first attribute for storing the unique identifier of the        process element of the respective process step,    -   a second attribute for storing the identifier of the respective        process step, and    -   a third attribute for storing the order of the process steps        within a process element.

Advantageous implementations can include one or more of the followingfeatures.

The identifier of a single process step and the unique identifier of theprocess element assigned to the single process step and the orderassigned to the single process step may form a single data record whichis stored with the predetermined data structure.

The order of the process step may comprise at least one of timestamp andtime interval.

Advantageously, a number of process sensors may be provided to theprocessor. The number of process sensors may be executed by theprocessor in order to create a complete event log.

The number of process sensors may be combined according to a number ofrules in order to create different event logs. The rules may be providedto the processor. Alternatively, the rules may be derived, by theprocessor, from the process sensors provided.

An event log package may be provided to the processor, the event logpackage containing the number of process sensors.

Advantageously, the at least one process sensor may comprise at leastone sensor statement. The at least one process sensor may be executed byexecuting at least one sensor statement of the at least one processsensor.

The at least one sensor statement may be provided in an independentrepresentation, where the processor converts the independentrepresentation of the sensor statement into an executable representationfor being executed with a predetermined execution environment.

The execution environment may comprise a database system, a dataprocessing platform and/or an execution environment for data processingtasks.

Further, a set of parameters may be assigned to the at least one processsensor. The values of the parameters may control the behavior of theprocess sensor when executed by the processor.

Yet further, at least one value of the parameters assigned to a firstprocess sensor may control the behavior of at least one second processsensor.

The generated data stored with the storage means may be provided to aprocess mining system.

Furthermore, the method may further comprise

-   -   creating a set of tables and/or files and storing auxiliary data        with the tables and/or files, where the auxiliary data belong to        the generated data stored with the predetermined data structure,    -   creating a data model describing the predetermined data        structure, the set of tables and/or files and the relations        between the tables and/or files and the predetermined data        structure, and    -   providing the set of tables and/or files, the data model and the        generated data stored with the predetermined data structure to a        process mining system.

Advantageously, the at least one process sensor is adapted to create theset of tables and/or files.

Further, the at least one process sensor may be adapted

-   -   to generate from the raw data and/or from the derived process        data the auxiliary data, and    -   to store the auxiliary data with the tables and/or files.

The event log package may be provided to a package store for beingdownloaded by a user of a process mining system. The event log packagemay contain all process sensors which are necessary for the analysis ofone specific business process within the process mining system.

The package store may provide functionality to the user of the processmining system to

-   -   purchase existing event log packages, and/or    -   sell and distribute own event log packages, and/or    -   rate and comment existing event log packages, and/or    -   search for event log packages.

The execution of the at least one process sensor may be triggeredaccording to a time schedule.

Furthermore, the invention comprises a computer program product,comprising a computer readable storage means, comprising program codefor performing the inventive method, when loaded into a computer system.

Further provided is a computer-based system, comprising:

-   -   a processor,    -   a storage means being operatively coupled to the processor, for        storing an event log according to a predetermined data structure        and auxiliary data which belong to the event log, and    -   a computer readable storage medium being operatively coupled to        the processor, the computer readable storage medium comprising        program code for performing the inventive method, when loaded        into a computer system.

The following advantages apply when using process sensors to createevent logs instead of using database query scripts:

-   -   All process sensors are transparent regarding the underlying        target database. With traditional methods one has to implement        the whole data integration procedure in different dialects.    -   Different process sensors can easily combined to create one        event log. With monolithic data integration procedures this        involves manual changes of the procedure.    -   Creating process sensors with a graphical user interface is not        possible when writing database queries to define an event log.    -   Process sensors can be combined to form a business process        package with multiple sensors.    -   Process sensors can be configured to specifics of the source        data system.    -   Process sensors are able to create data models of the created        event logs and other tables/files out of the process sensor        definition.    -   Sets of process sensors can be executed as one-time execution or        at fixed time intervals.    -   Within a set of process sensors dependencies between the process        sensors and their configurations can be used to allow        conditional execution of process sensors.

BRIEF DESCRIPTION OF THE FIGURES

Details and features of the invention as well as specific embodiments ofthe invention can be derived from the subsequent description inconnection with the drawing, in which:

FIG. 1 shows the relation of an event log package to an analyticspackage;

FIG. 2 shows a number of process sensors of an example event logpackage;

FIG. 3 shows a number of event log packages and analytics packageswithin a package store;

FIG. 4 shows an execution scheme of a script to create an event log; and

FIG. 5 shows an example event log which is created by executing a numberof process sensors.

DETAILED DESCRIPTION OF THE INVENTION

The analysis of business process by a process mining application is forthe most part conducted in two stages:

-   -   In the first stage the raw data from the IT source system is        transformed into a representation which is capable for process        mining applications. This transformation is conducted by process        sensors which are part of an event log package. This package and        its components resemble the object of invention.    -   The second stage involves the usage of the event log to address        business process questions. Since the raw event log from the        event log package is not capable of addressing business process        questions on its own further analytics packages are stacked on        top of the event log package. These contain prepared analyses        which are built on top of an event log package and contain        insights for non-technical business process professionals.

The relation and the content of both the event log package and theanalytics package are depicted in FIG. 1.

Event Log Package

The above-mentioned process components are mapped to technicalrepresentations within the source system by executing one or moreprocess sensors. Based on the technical representations the process canbe reconstructed solely from the traces which have been left on thesource system. The mapped representations are:

-   -   A unique identifier for the process element. This identifier        relates to the element which is being processed.    -   A set of process steps which a process element can pass during        its process. Not every step has to be fulfilled by the process        element.    -   The order of the process steps. If every process step has a        timestamp (or even a time span) attached to the process step,        not only can the order of the steps be reconstructed but also        specific time differences between different process steps can be        determined.

These technical components (i.e. the mapped representations) lead thento a data structure of an event log which is the input for processmining systems. The creation of the data structure is performed by theprocess sensors.

Thus, a process sensor is adapted to derive process data from the rawdata comprising the digital traces of the executed processes, and togenerate from the derived process data the event log.

The data structure consists in the simplest structure of three columnswhich reflect the aforementioned process components:

-   -   an unique ID,    -   a process step, and    -   an order of the process steps.

The order may be an attribute that allows sorting, preferably a singletimestamp or multiple time stamps representing one or more time spans.

An example of an event log with a single timestamp is given in thefollowing table.

Unique ID Process Step Timestamp (Order) 1 Purchase Requisition2012-01-01 13:05 1 Purchase Requisition Approval 2012-01-01 15:09 1Purchase Order Item 2012-01-02 17:03 1 Goods Receipt 2012-01-03 13:01 1Invoice Receipt 2012-01-03 15:00 2 Purchase Requisition 2012-01-05 11:002 Purchase Requisition Approval 2012-01-05 17:00 . . .

An example of an event log with multiple timestamps is given in thefollowing table.

Unique ID Process Step Timestamp (Start) Timestamp (End) 1 PurchaseRequisition 2012-01-01 13:05 2012-01-01 13:15 1 Purchase Order Item2012-01-02 17:03 2012-01-02 17:13 1 Goods Receipt 2012-01-03 13:012012-01-03 14:01 1 Invoice Receipt 2012-01-03 15:00 2012-01-03 15:10 2Purchase Requisition 2012-01-03 15:00 2012-01-03 15:15 2 Purchase OrderItem 2012-01-05 17:00 2012-01-05 17:10 . . .

Given such an event log, the as-is process may be reconstructed byprocess mining algorithms.

In the following, the components “Process sensor” and the “event logpackage” are explained in further detail.

The Component Process Sensor

A process sensor is able to sense the necessary data for a process stepout of the source data, i.e., raw data stored in the source systems.

Thus, a process sensor is a unit which can be applied to the raw data ofthe source system to sense one or multiple process steps. The respectivechanges which were triggered in the raw data are then converted into theaforementioned structure of an event log. The minimal set of data whichis sensed are the ones mentioned before:

-   -   one (or multiple) process step description(s),    -   one (or multiple) order attributes (e.g. timestamps/time spans)        which correspond to one process step, and    -   one unique ID which corresponds to a process element.

One process sensor is preferably independent of the data storage layer.

Definition of a Process Sensor

In a source system which handles processes the data is usually savedinto tables which reside in a data storage, e.g. in a database system.The different data fields which are sensed by the process sensor(s) areoften scattered among different tables. The relations between thedifferent tables have to be defined within the process sensor(s).

With this requirement a process sensor S can be defined as a tuple ofthe data set mentioned before with a unique identifier I, a process stepP, an order attribute T and further attributes V:

S=

I,P,T,V

This n-tuple is evaluated during the execution of the sensor S and theresults consists of an event log with these columns.

The unique identifier I can further be defined as:

I=

Δ∞ . . . ∞Γ,λ

where Δ and Γ stand for the tables containing the fields necessary forthe unique identifier λ corresponding to the process object. The uniqueidentifier λ can consist of any transformation of the fields containedin the consecutive join over (possibly) multiple tables from Δ to Γ.

The process step P can further be defined as:

P=

Π,π,d,Δ∞ . . . ∞Γ∞ . . . ∞Π

where Π corresponds to the table holding the process step description inthe field π. d stands for a fixed prefix for the process step. Theconsecutive join over (possibly) multiple tables from the uniqueidentifier Δ to the process step table Π allows to retrieve the processstep name π from a transformation using the fields from all joinedtables.

Similar, the order T can be defined as:

T=

Ω,ω,Δ∞ . . . ∞Γ∞ . . . ∞Ω

where Ω corresponds to the table holding the order attribute in thefield ω. ω can either resemble a single value (e.g. a single timestamp)or a pair of values (e.g. timestamps to indicate start- and end time ofan event). It can be retrieved from any transformation of the fieldsgiven by all joined tables.

The further attributes V corresponds to data which can be added directlyto the event log data structure or is added to a different table or filewith a relation to the event log. It can also be defined as:

V=

Σ,σ,Δ∞ . . . ∞Γ∞ . . . ∞Σ

where Σ corresponds to the table holding the additional attributes inthe field σ. σ must not only be a fixed field but can also be the resultof a transformation which is based on the fields given by all joinedtables.

Configuration of a Process Sensor

Since not every detail in the source systems is the same, processsensors can be configured. Every process sensor can have multipleparameters which can be adjusted. These adjustments are later necessarywhen creating an event log.

The configuration provides a set of value for parameters which werepredefined in the process sensors. These values are then subsequentlyreplaced in the process sensors, thus the sensors are then configuredfor a particular working environment.

Beside the simple configuration with a search/replace technique theprocess sensor also provides more complex configuration options to:

-   -   define conditions for the execution of different parts of the        process sensors. These conditioned executions can then be        controlled by the configurations parameters.    -   define loops and multiple executions of parts of the process        sensors.

The process sensor also provides the possibility to maintain variableswhich can be set in first process sensor and affect the execution of atleast a second sensor.

With these configuration options complex use cases can be configured.

Execution of One or Multiple Process Sensors

In the following the creation of an event log is described in furtherdetail.

The above-described components allow the creation of an event log basedon a set of process sensors. In a common approach the event log can becreated by a monolithic sequence of data query language commands (mostlySQL-Script). Such a schema is shown in FIG. 4 where a set ofSQL-commands generate creates the event log.

Multiple different process sensors can be used in order to generate acomplete event log. In this case each process sensor senses a subset ofprocess steps and therefore contributes its steps to the complete eventlog. FIG. 5 shows this behavior as an example, where different parts ofthe event log are generated by different process sensors.

This enables to combine multiple process sensors in a modular fashionwhere each event log line can be the result of a different processsensor. The user then specifies the parameter settings to configure theexecution of the process steps. This configuration is then applied toall process sensors. Furthermore, the user has to provide a datarepresentation scheme (e.g. a database) where the source system data(i.e. the raw data) can be sensed. Then the sensors pick up the processsteps and forms the event log. This sensing can not only be carried outin a one-way fashion but also in a scheduled manner. Thus, the sensingmay for example take place every day at a fixed point in time.

After the sensing of the digital traces which leads to the event logdata structure the foundation for applying process mining algorithms arelaid out.

Development Framework

While the preconfigured process sensors are set up for an immediateusage by a non-expert user, an extensive development framework is alsoprovided. This framework supports both interaction by a scriptinglanguage and with a graphical user interface.

The creation of the process sensors with all elements mentioned beforecan either be carried out in a scripted/programmed fashion or through agraphical user interface.

In the scripted interface the relations, source tables, target tablesand other attributes are scripted in a programming language.

Besides the scripted/programmed interface a graphical user interface isprovided to create process sensors solely via a graphical interface. Theinterface provides an overview over all tables where the user can thenchoose by mouse operations which fields and relations are resembling theprocess sensor.

Both, the scripted and the graphical user interface are independent froman underlying execution environment. From the graphical user interfaceinput as well as from the scripted programming language the executablecode for the underlying execution platform is generated during runtime.

The Component Event Log Package

One event log process package contains all process sensors which arenecessary for the analysis of one or more specific business processes.Business processes consist of multiple process steps which cannotnecessarily be combined into one process sensor. To account for multiplesensors, multiple process sensors can be combined within one event logprocess package. An example of an event log process package is depictedin FIG. 2. In this example “Purchase to Pay” represents the event logpackage and “Create PR Items”, “Change Quantity”, “Change Price” and“Goods Receipt” represent the process sensors of the event log package“Purchase to Pay”.

The process sensors itself only sense the process data and create theevent log data structure. Based on this data structure process mining isalready possible.

Besides the event log as a process mining capable data structure thepackage also contains a data model which describes the structure of allelements which have been created by the packages process sensors. Thisdata model must not only contain data structures created by the processsensors but also additional tables which have been linked to the eventlog.

Examples of Process Sensors

In the following two examples for process sensors are given: one simpleprocess sensor (Invoice paid sensor) and one complex sensor (Change ofcontent sensor).

1. Invoice Paid Sensor

The “Invoice paid sensor” senses the process step when an invoice hasbeen paid in an ERP-system. To sense this process step all invoices areconsidered and as soon as an invoice has a valid date in the field“clear date” this process step is successfully sensed. The data which isthen sent to the event log is:

-   -   the invoice ID as the unique ID,    -   the “clear date” field content as the timestamp of the process        step, and    -   the process step description, where the process step description        may be fixed with “Invoice paid”.

Assuming this invoice paid sensor is used in a standard SAP FIenvironment, the above-mentioned formal definition

I, P, T, V

would be:

I=

Δ,λ

=

BSEG,{MANDT,BUKRS,BELNR,GJAHR,BUZEI}

P=

Π,π,d,Δ∞ . . . ∞Π

=

BSEG,−,“Invoice paid”,−

T=

Ω,ω,Δ∞ . . . ∞Ω

BSEG,AUGDT,−

V=−

Since all fields are within the same table (BSEG) no joins were needed.The resulting output would then look like this:

Unique ID Process Step Timestamp (Order) 1 Invoice paid 2012-01-01 2Invoice paid 2012-01-01 . . .

2. Change of Content Sensor

The “Change of content sensor” senses all process steps which belong toa change of the content of an invoice. All fields which are analysed bythe source system in change logs can then be used as a change processstep. The data which is sent to the event log is:

-   -   the invoice ID as the unique ID,    -   the “change date” of the respective field as timestamp of the        process step, and    -   the process step description—in this example the process step        description is defined by the prefix “Change of:” and the        fieldname which was changed. For example: “Change of: invoice        amount”.

Assuming this invoice paid sensor is used in a standard SAP FIenvironment the formal definition

I, P, T, V

would be:

I=

Δ,λ

=

BSEG,{MANDT,BUKRS,BELNR,GJAHR,BUZEI}

P=

Π,π,d,Δ∞ . . . ∞Π

=

CDPOS,FNAME,“Change of:”,BSEG∞CDPOS

T=

Ω,ω,Δ∞ . . . ∞Ω

=

CDHDR,UDATE,BSEG∞CDPOS∞CDHDR

V=−

In this more complex process sensor three tables are involved: theinvoice table “BSEG” and two change log tables “CDPOS” and “CDHDR”.Since the unique ID is retrieved from the invoice table “BSEG”, theprocess step from the table “CDPOS” and the timestamp from the table“CDHDR” these three tables have to be related within this processsensor.

The resulting output would then look like this:

Unique ID Process Step Timestamp (Order) 1 Change of: ERNAM 2012-03-01 2Change of: ZLSPR 2012-04-01 . . .

Analytics Package

To answer business process questions the event log and the furthertables are not sufficient. The business process professional requires anon-technical way to approach a process mining system. To bridge the gapfrom the technical event log to business process perspective theanalysis package provides prepared analyses to the end user.

The Component Analytics Package

Based upon the process event log and the data model as a description ofthe process event log an analytics package is defined as a set of:

-   -   Plots, charts and tables based on process event log data,    -   Directed graphs which show the process flow for the current        selection,    -   Describing text and graphic components.

Such an analytics package is pre-configured for a process mining systemto give an insight into a specific business process. The perspective ofthe view on the process is defined in such a way, that a particularbusiness process question is tackled and the analytics package istherefore useful for a process professional.

Each analytics package has the following further properties:

-   -   The analytics package is customizable with parameters to fit        different event log and table variants.    -   The analytics package is able to drill down onto different        features from the configured data model.

Relation to the Event Log Package

Since all non-static components of the analytics package (e.g. plots,charts, process visualization) require data to be displayed, eachanalytics package is built on top of an event log package. The event logpackage provides by the means of a data model a comprehensivedescription of the event log and all connected tables. Since each eventlog package can contain information for multiple analytics packages therelation between the event log package and the analytics package is one(event log package) to multiple (analytics package). On the other hand,an analytics package can only be operated when the specified event logpackage is present. FIG. 1 shows the relation of an event log package toan analytics packages.

Analytics package Examples

Two examples for analytics packages are given here for the“Purchase-to-Pay” (P2P) Process: A throughput time analytics package anda process conformance analytics package.

1. Purchase to Pay Throughput Time Analytics Package

This analytics package gives the process professional the opportunity todetermine the time which has passed between two process steps. Itcontains:

-   -   A process graph visualization which shows all process steps as        nodes in a directed graph.    -   On the edges of the process graph the average time between        consecutive process steps.    -   The possibility to choose two process steps for which the        average throughput time is shown over various axes. These axes        can be:        -   Company code        -   Purchasing group        -   Plant        -   . . .    -   The average throughput time between these two process steps is        shown over time as a line plot.

With this analytics package the process professional is able to:

-   -   Determine parts of the process which take most of the process        throughput time    -   Identify parts of his organization (company codes, purchasing        groups . . . ) which are outlier with respect to the average        throughput time.    -   Check if the throughput time, after counter measures against        delays were conducted, has shorten.

2. Purchase to Pay Process Conformance Analysis

This analytics package gives a process professional the opportunity toanalyze the process conformance of the purchase to pay process. Itcontains:

-   -   A process graph visualization which shows all process steps as        nodes in a directed graph.    -   The edges of the process graph are colored green if the process        step is conform to the defined process and red if this step was        not designated to be part of this process.    -   The possibility to show the average percentage of cases being        conform to the defined process. These axes can be:        -   Company code        -   Purchasing group        -   Plant        -   . . .    -   The average percentage of cases being conform shown over time as        a line plot.

With this analytics package the process professional is able to:

-   -   Identify parts of his organization (company codes, purchasing        groups . . . ) which are outlier with respect to the percentage        of non-conform process cases.    -   Monitor if, after counter measures were applied against process        violations, the average percentage of non-conform cases is        decreasing.

Package Store

The package store (shown in FIG. 3) resembles a platform which acts as asingle entry point to retrieve both event log and analytics packages forthe user's process mining application.

Since the event log packages provides the necessary technical foundationfor the analytics package, one can:

-   -   Purchase and retrieve existing event log packages which allow        the usage of analytics package for the specific process.    -   Sell and distribute own event log packages to other users of the        platform.    -   Rate and comment on existing event log packages    -   Search for event log packages

To make use of the event log packages for the business processprofessional with analytics packages, one can use the platform to:

-   -   Purchase and retrieve existing packages from the package store.        If the event log package has not been previously retrieved the        event log package must be retrieved beforehand.    -   Sell and distribute own packages to other users of the platform.    -   Rate and comment on existing packages.    -   Search for packages.

The invention can be implemented in digital electronic circuitry, or incomputer hardware, firmware, software, or in combinations of them. Theinvention can be implemented as a computer program product, that is, acomputer program tangibly embodied in an information carrier, forexample, in a machine-readable storage device or in a propagated signal,for execution by, or to control the operation of, data processingapparatus, for example, a programmable processor, a computer, portablecomputer, smartphone, or multiple computers. A computer program can bewritten in any form of programming language, including compiled orinterpreted languages, and it can be deployed in any form, including asa stand-alone program or as a module, component, subroutine, or otherunit suitable for use in a computing environment. A computer program canbe deployed to be executed on one computer or on multiple computers atone site or distributed across multiple sites and interconnected by acommunication network.

Method steps of the invention can be performed by one or moreprogrammable processors executing a computer program to performfunctions of the invention by operating on input data and generatingoutput. Method steps can also be performed by, and apparatus of theinvention can be implemented as, special purpose logic circuitry, e.g.,an FPGA (field programmable gate array) or an ASIC (application-specificintegrated circuit).

Processors suitable for the execution of a computer program include, byway of example, both general and special purpose microprocessors, andany one or more processors of any kind of digital computer. Generally, aprocessor will receive instructions and data from a read-only memory ora random access memory or both. The essential elements of a computer area processor for executing instructions and one or more memory devicesfor storing instructions and data. Generally, a computer will alsoinclude, or be operatively coupled to receive data from or transfer datato, or both, one or more mass storage devices for storing data, forexample, magnetic, magneto-optical disks, or optical disks. Informationcarriers suitable for embodying computer program instructions and datainclude all forms of non-volatile memory, including by way of examplesemiconductor memory devices, for example, EPROM, EEPROM, and flashmemory devices; magnetic disks, for example, internal hard disks orremovable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.The processor and the memory can be supplemented by, or incorporated inspecial purpose logic circuitry. The data can be stored in a databasemanagement system, e.g. a relational database management system, objectoriented database management system, or hierarchical database managementsystem.

The invention can be implemented in a computing system that includes aback-end component, for example, as a data server, or that includes amiddleware component, for example, an application server, or thatincludes a front-end component, for example, a client computer having agraphical user interface or a Web browser through which a user caninteract with an implementation of the invention, or any combination ofsuch back-end, middleware, or front-end components. The components ofthe system can be interconnected by any form or medium of digital datacommunication, for example, a communication network. Examples ofcommunication networks include a local area network (“LAN”) and a widearea network (“WAN”), e.g., the Internet.

The computing system can include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other.

The invention has been described in terms of particular embodiments.Other embodiments are within the scope of the following claims. Forexample, the steps of the invention can be performed in a differentorder and still achieve desirable results. Accordingly, otherembodiments are within the scope of the following claims.

I claim:
 1. A computer-implemented method for generating, in a computersystem having a processor and a storage means operatively coupled to theprocessor, an event log from raw data stored in a source system, whereinthe method comprises (a) providing at least one process sensor to theprocessor, (b) executing, by the processor, the at least one processsensor provided to the processor, wherein the at least one processsensor is adapted to derive process data from the raw data, wherein theprocess data comprises at least one process element and the at least oneprocess element comprises at least one process step, and to generatefrom the derived process data: unique identifiers of process elements,identifiers of process steps which are assigned to the process elements,and an order of the process steps, and (c) storing, by the processor,the generated data as an event log with the storage means according to apredetermined data structure, the predetermined data structurecomprising at least a first attribute for storing the unique identifierof the process element of the respective process step, a secondattribute for storing the identifier of the respective process step, anda third attribute for storing the order of the process steps within aprocess element.
 2. The method of claim 1, wherein the identifier of asingle process step and the unique identifier of the process elementassigned to the single process step and the order assigned to the singleprocess step form a single data record which is stored with thepredetermined data structure.
 3. The method of claim 1, wherein theorder of the process step comprises at least one of timestamp and timeinterval.
 4. The method of claim 1, wherein a number of process sensorsare provided to the processor and wherein the number of process sensorsare executed by the processor in order to create a complete event log.5. The method of claim 4, wherein the number of process sensors arecombined according to a number of rules in order to create differentevent logs, wherein the rules are provided to the processor or whereinthe rules are derived, by the processor, from the process sensorsprovided.
 6. The method of claim 4, wherein an event log package isprovided to the processor, the event log package containing the numberof process sensors.
 7. The method of claim 1, wherein the at least oneprocess sensor comprises at least one sensor statement and wherein theat least one process sensor is executed by executing at least one sensorstatement of the at least one process sensor.
 8. The method of claim 7,wherein the at least one sensor statement is provided in an independentrepresentation, wherein the processor converts the independentrepresentation of the sensor statement into an executable representationfor being executed with a predetermined execution environment.
 9. Themethod of claim 8, wherein the execution environment comprises adatabase system, a data processing platform and/or an executionenvironment for data processing tasks.
 10. The method of claim 1,wherein a set of parameters is assigned to the at least one processsensor, wherein the values of the parameters control the behavior of theprocess sensor when executed by the processor.
 11. The method of claim10, wherein at least one value of the parameters assigned to a firstprocess sensor controls the behavior of at least one second processsensor.
 12. The method of claim 1, wherein the generated data storedwith the storage means is provided to a process mining system.
 13. Themethod of claim 1, wherein the method further comprises creating a setof tables and/or files and storing auxiliary data with the tables and/orfiles, where the auxiliary data belong to the generated data stored withthe predetermined data structure, creating a data model describing thepredetermined data structure, the set of tables and/or files and therelations between the tables and/or files and the predetermined datastructure, and providing the set of tables and/or files, the data modeland the generated data stored with the predetermined data structure to aprocess mining system.
 14. The method of claim 13, wherein the at leastone process sensor is adapted to create the set of tables and/or files.15. The method of claim 13, wherein the at least one process sensor isadapted to generate from the raw data and/or from the derived processdata the auxiliary data, and to store the auxiliary data with the tablesand/or files.
 16. The method of claim 6, wherein the event log packageis provided to a package store for being downloaded by a user of aprocess mining system, wherein the event log package contains allprocess sensors which are necessary for the analysis of one specificbusiness process within the process mining system.
 17. The method ofclaim 16, wherein the package store provides functionality to the userof the process mining system to purchase existing event log packages,and/or sell and distribute own event log packages, and/or rate andcomment existing event log packages, and/or search for event logpackages.
 18. The method of claim 1, wherein the execution of the atleast one process sensor is triggered according to a time schedule. 19.A computer program product, comprising a computer readable storagemeans, on which computer readable instructions are stored, which, ifexecuted in a processor of a computer, instruct the processor of thecomputer to execute a method for generating an event log from raw dataaccording to claim 1, wherein the processor is coupled to a storagemeans operatively, wherein the event log is stored, by the processor,with the storage means.
 20. A computer-based system, comprising: aprocessor, a storage means being operatively coupled to the processor,for storing an event log according to a predetermined data structure andauxiliary data which belong to the event log, and a computer readablestorage medium being operatively coupled to the processor, whereininstructions are stored on the computer readable storage medium, which,when executed by the processor of the system, instruct the processor ofthe system to execute a method according to claim 1 for generating anevent log from raw data and storing the generated event log and theauxiliary data with the storage means.